Privacy notice

1. Data controller

The data controller is Fala Noleggi SRL, registered office Via Natale Sandre 22/A, 10078 Venaria Reale (TO), Italia, VAT no. 13160840016. For any privacy question, write to privacy@eurostelle.com.

2. Data we process

• Account: full name, email, password (stored only in encrypted form), language. If you sign in with Google, Google only shares your name and email and confirms the email is yours: we never receive your Google password and we don't keep your profile photo or any other data from your Google account.
• Player profile: first and last name, date of birth, men's or women's football, nationality, area (town, province, region and how far you will travel to play), position, foot, height, team, level, seasons played, description, video links. To calculate distances we use the centre of your town, never your address.
• Searching for pitches near you: if you press “Near me”, your phone sends us its location rounded to about 100 metres, only for that search, and we don't store it. If you type an address, we send it to OpenStreetMap's Nominatim service to find the point on the map, without any data about you.
• “Ask if it's free”: the message to the pitch is sent from your phone (WhatsApp, call or copied text) and we don't read it. We only count how many requests each pitch receives, with the day you chose, without knowing who you are.
• Parent of a minor: full name, email, phone, the electronic signature (typed name), the consents given and, if provided, the other parent's email.
• Talent seekers: club or business, role, phone, website, licence or registration number, description.
• Messages exchanged on the site and reports.
• Pitch bookings: name, phone, day and time, chosen pitch and notes. For sports venues: company name, VAT number (with the result of the EU VIES check), venue phone and email.
• Subscriptions: plan, status, dates, amounts paid and billing details (name, address, VAT number if any) entered on Stripe's payment page. Never card details.
• Sports agents and agencies we invite to join: name, agency, licence number, city and business contact details taken from public sources (FIGC federal register of sports agents, agencies' websites), with the source recorded.
• Technical data: IP address and browser type, used for security and as proof of consent; date of profile views by talent seekers.
• Where the sign-up came from: the QR code of a school or pitch, or an ambassador's link.

3. Purposes and legal bases

• To create the account and run the service (performance of a contract, Art. 6(1)(b) GDPR).
• To show the profile to verified talent seekers, for the public page and for videos: with consent (Art. 6(1)(a) GDPR). For minors, consent is given by the parent (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code).
• To verify talent seekers, prevent fraud and abuse and protect minors (legitimate interest, Art. 6(1)(f) GDPR).
• To comply with legal obligations, e.g. tax rules once subscriptions start (Art. 6(1)(c) GDPR).
• To demonstrate that consent was given or withdrawn (Art. 7(1) GDPR).
• For pitch bookings: sending the request to the venue, confirmations and reminders, and showing you the venue's phone if it doesn't reply (performance of a contract, Art. 6(1)(b) GDPR).
• For sports venues: managing the contract and invoices (Art. 6(1)(b) and 6(1)(c) GDPR) and checking the VAT number in the EU VIES database, to know who we work with and prevent fraud (legitimate interest, Art. 6(1)(f) GDPR).
• To invite sports agents and agencies to use EuroStelle: one phone call to their public business contacts, with this information; the invitation link only to those who ask for it (legitimate interest, Art. 6(1)(f) GDPR). Anyone who doesn't want to be contacted again is deleted immediately.

4. Who sees the data

• Clubs, scouts and agents verified by us see profiles. For minors they only see first name and initial, age, area and football data: never the parent's contact details.
• Only adults who ask for it have a public page, also visible on Google.
• Suppliers that help us run the site (hosting in Italy, email delivery), as data processors.
• If you choose “Continue with Google”, Google knows that you used its sign-in to enter EuroStelle: Google processes this as an independent controller, under its own privacy policy (policies.google.com/privacy).
• The sports venue you request a pitch from receives the name, phone, day and time and notes of the booking, only to manage it: for this data it is an independent controller.
• Matches with friends: the organiser and co-organisers see who replied (with the time) and who opened the match page while signed in; other participants only see who replied.
• Verified talent seekers can search by area: they see how many km the player's town is from the town they chose and how far the player said they would travel, never the address.
• Pitch map: when you open it, your browser downloads the map images from OpenFreeMap (data © OpenStreetMap), which, like any website, sees your connection's IP address. The map only loads if you open it.
• Subscriptions: payments are handled by Stripe (Stripe Payments Europe Ltd, Ireland) as our processor, and as an independent controller for its legal obligations and fraud prevention. EuroStelle never sees or stores card details: it only receives the subscription status, amounts and billing details from Stripe.
• Authorities, when required by law.
• We never sell or share data for advertising.

5. Minors: extra rules

• The minimum age is 14. From 14 to 17, the profile is created by a parent (or guardian) with their own email: the account belongs to the parent.
• The parent signs electronically by typing their full name, declares that they exercise parental responsibility and that the other parent is informed and agrees. We record date, time, IP address and the accepted text, and send a receipt.
• The profile becomes visible only after the parent confirms their email.
• The parent can give the other parent's email: they receive a link to confirm. If they disagree, the profile is hidden.
• A minor's profile never appears on Google and shows a shortened name. Messages go to the parent.
• The parent can withdraw consent at any time from their account: the profile and messages are deleted.
• At 18, the player can take over the profile with their own email and give consent themselves.

6. How long we keep data

• Account and profile: while active. After 24 months without logins we notify you and then delete them.
• Messages: as long as the account exists.
• Proof of consent and of its withdrawal: up to 5 years after withdrawal or account closure, only to be able to demonstrate it.
• Log of emails sent: 24 months.
• Pitch bookings: 24 months after the match; then we remove name, phone and notes and only the number of matches remains. Invoices and contracts with venues: 10 years, as required by law (Art. 2220 of the Italian Civil Code).
• Subscriptions and payments: for the whole duration of the subscription; invoices and payment records 10 years (Art. 2220 of the Italian Civil Code).
• Invited agents and agencies: until they sign up, and no longer than 12 months after the last contact; then contact details are deleted. Only the name remains, so that people who said no are not contacted again.

7. Your rights

You can request access to your data, rectification, erasure, restriction, portability, object to processing and withdraw consent at any time by writing to privacy@eurostelle.com. We reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.

8. Where data is stored

Data is stored on servers in Italy. We do not host videos: they are links to YouTube or Vimeo, managed by the player or parent in their own account on those services.

9. Security

Encrypted passwords, secure connection (HTTPS), profile access only for verified users, limits against repeated attempts, log of important actions.